Skip to content

Fix panic when receiving with --stdout and invalid secret#993

Merged
schollz merged 2 commits intomainfrom
copilot/fix-panic-on-invalid-secret
Oct 31, 2025
Merged

Fix panic when receiving with --stdout and invalid secret#993
schollz merged 2 commits intomainfrom
copilot/fix-panic-on-invalid-secret

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Oct 31, 2025 •
edited
Loading

When receiving with --stdout and an invalid CROC_SECRET, the program panics with index out of range [0] instead of returning an error gracefully.

Changes

  • src/croc/croc.go: Add bounds check before accessing FilesToTransfer[c.FilesToTransferCurrentNum] in stdout cleanup path
  • src/croc/croc_test.go: Add test case TestReceiverStdoutWithInvalidSecret to verify graceful error handling

Details

The stdout cleanup code at line 1178 assumed FilesToTransfer was populated, but when authentication fails early in the transfer, the array remains empty:

// Before: panics when FilesToTransfer is empty
if c.Options.Stdout && !c.Options.IsSender {
    pathToFile := path.Join(
        c.FilesToTransfer[c.FilesToTransferCurrentNum].FolderRemote,  // panic here
        ...
    )
}

// After: checks bounds before access
if c.Options.Stdout && !c.Options.IsSender && 
   len(c.FilesToTransfer) > 0 && 
   c.FilesToTransferCurrentNum < len(c.FilesToTransfer) {
    // safe to access
}

With this fix, invalid secrets now return: room (secure channel) not ready, maybe peer disconnected

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • 239.255.255.250
  • croc.schollz.com
    • Triggering command: ./croc --version (dns block)
    • Triggering command: /tmp/go-build2651178820/b001/croc.test -test.testlogfile=/tmp/go-build2651178820/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
    • Triggering command: /tmp/go-build3825911463/b001/croc.test -test.testlogfile=/tmp/go-build3825911463/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • croc6.schollz.com
    • Triggering command: ./croc --version (dns block)
    • Triggering command: /tmp/go-build2651178820/b001/croc.test -test.testlogfile=/tmp/go-build2651178820/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
    • Triggering command: /tmp/go-build3825911463/b001/croc.test -test.testlogfile=/tmp/go-build3825911463/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • doesntexistok.com
    • Triggering command: /tmp/go-build2651178820/b001/croc.test -test.testlogfile=/tmp/go-build2651178820/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
    • Triggering command: /tmp/go-build227569924/b001/croc.test -test.testlogfile=/tmp/go-build227569924/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
    • Triggering command: /tmp/go-build77411867/b001/croc.test -test.testlogfile=/tmp/go-build77411867/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true -test.run=TestReceiverStdoutWithInvalidSecret|TestCrocLocal|TestCrocError (dns block)
  • example.com
    • Triggering command: /tmp/go-build1733538028/b286/models.test -test.testlogfile=/tmp/go-build1733538028/b286/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • ipv4.icanhazip.com
    • Triggering command: /tmp/go-build1733538028/b292/utils.test -test.testlogfile=/tmp/go-build1733538028/b292/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
    • Triggering command: /tmp/go-build3215944763/b001/utils.test -test.testlogfile=/tmp/go-build3215944763/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • this-hostname-should-definitely-not-exist-98765
    • Triggering command: /tmp/go-build1733538028/b286/models.test -test.testlogfile=/tmp/go-build1733538028/b286/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • this-hostname-should-not-exist-12345
    • Triggering command: /tmp/go-build1733538028/b286/models.test -test.testlogfile=/tmp/go-build1733538028/b286/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Original prompt

This section details on the original issue you should resolve

<issue_title>[Bug]: Panic when receiving with --stdout and invalid CROC_SECRET</issue_title>
<issue_description>### What happened?

Panic when receiving with --stdout and invalid CROC_SECRET

What did you expect to happen?

The program should handle invalid secrets gracefully and exit with an appropriate error message.

Steps to reproduce

  1. Run croc receiver with --stdout flag and an invalid secret:
   CROC_SECRET=asdbajhdad ./croc --stdout
  1. The program panics instead of handling the error gracefully

croc version

v10.2.7

Operating System

Linux

OS Version

Debian 13

Relevant log output

$ CROC_SECRET=asdbajhdad ./croc
securing channel...room (secure channel) not ready, maybe peer disconnected
$ CROC_SECRET=asdbajhdad ./croc --stdout 
securing channel...panic: runtime error: index out of range [0] with length 0

goroutine 38 [running]:
github.com/schollz/croc/v10/src/croc.(*Client).transfer(0xc00030a008)
	/home/runner/work/croc/croc/src/croc/croc.go:1180 +0x8d1
github.com/schollz/croc/v10/src/croc.(*Client).Receive(0xc00030a008)
	/home/runner/work/croc/croc/src/croc/croc.go:1102 +0x1432
github.com/schollz/croc/v10/src/cli.receive(0xc0001312c0)
	/home/runner/work/croc/croc/src/cli/cli.go:709 +0xd69
github.com/schollz/croc/v10/src/cli.Run.func1(0xc0001312c0)
	/home/runner/work/croc/croc/src/cli/cli.go:206 +0x505
github.com/schollz/cli/v2.(*App).RunContext(0xc00012c600, {0xa705f8, 0xe5eb40}, {0xc00010e080, 0x2, 0x2})
	/home/runner/go/pkg/mod/github.com/schollz/cli/v2@v2.2.1/app.go:315 +0x90d
github.com/schollz/cli/v2.(*App).Run(...)
	/home/runner/go/pkg/mod/github.com/schollz/cli/v2@v2.2.1/app.go:217
github.com/schollz/croc/v10/src/cli.Run()
	/home/runner/work/croc/croc/src/cli/cli.go:209 +0x15e5
main.main.func1()
	/home/runner/work/croc/croc/main.go:40 +0x13
created by main.main in goroutine 1
	/home/runner/work/croc/croc/main.go:39 +0x71

Additional context

No response</issue_description>

Comments on the Issue (you are @copilot in this section)

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

@schollz
Fix panic when receiving with --stdout and invalid CROC_SECRET
f13a198 
Co-authored-by: schollz <6550035+schollz@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix panic when receiving with invalid CROC_SECRET Fix panic when receiving with --stdout and invalid secret Oct 31, 2025
Copilot AI requested a review from schollz October 31, 2025 14:58
@schollz schollz marked this pull request as ready for review October 31, 2025 15:12
@schollz schollz merged commit 74e69e9 into main Oct 31, 2025
@amrkmn amrkmn mentioned this pull request Nov 20, 2025
Closed
@BrewTestBot BrewTestBot mentioned this pull request Nov 20, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@schollz schollz Awaiting requested review from schollz

Assignees

@schollz schollz

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: Panic when receiving with --stdout and invalid CROC_SECRET

2 participants

@schollz